RARI Hacked Accident Analysis

Original title: "happy to do aggregation, but was attacked -- analysis of Rari hacked accident"

Source: Slow Fog Technology

On May 8, 2021, the Ethereum revenue aggregation protocol, Rari Capital, was reported to have lost nearly $15 million due to a bug in its integration with Alpha Finance. After the event, the official analysis report of the accident was released by RARI Capital, which analyzed the main causes of the accident. On the basis of the official analysis, the slow fog security team combined with the in-depth analysis of the incident to further interpret the cause of the security accident.

Attack detail analysis

This attack occurred in the Rarimanger contract of Rari Capital. In the whole process, the attacker first lent a huge amount of money from DYDX through the flash loan, and then repeatedly called the   in the Rarimanger contract. deposit  And & have spent withdraw  Function, complete profit. The diagram below:

So how do users get through   deposit  And & have spent withdraw  What are the two profitable operations? We need to analyze the corresponding function:

Above is & have spent deposit  Part of the logic of the function, first   deposit  The function itself calls the internal _depositTo function, and then calls the getFundBalance function again to get the balance of the contract. The getFundBalance function ultimately calls the getBalance function of the RARI Controller contract to get the balance. Finally, the balance is obtained through the getBalance function of AlphaPoolController library in the ARI Controller contract. The diagram below:

The process is a little more complicated, and it looks something like this:

From the above analysis, it is not difficult to find that the totalETH function of the ibETH contract of Alpha Finance project is finally used to obtain the balance of the contract in the ARI contract. The purpose is to calculate the real ETH balance of the ARI contract according to the ratio of TotalETH and TotalSupply. deposit  The function calculates the number of REPT to be issued to the user based on the number and ratio of the user's ETH recharge. withdraw  The formula for the function is similar. You need to get the balance of ETH and calculate the ratio through the getBalance function, and then calculate the amount of ETH that needs to be returned to the user based on the balance and ratio of the user's REPT token. But the problem lies in the formula for obtaining the ETH balance.

According to the official description, the value obtained from the totalETH function obtained from the ibETH contract can be manipulated by the user. Here is the official transcript:

According to the official description, the user can manipulate the value returned by the Totaleth function through the work function of the IBeth contract, causing the entire value calculation formula of RARI to crash. We analyze the work function and totalETH function of IBeth respectively:

TotalETH function:

The work functions:

The above are partial implementations of the totalETH function and the work function in the ibETH contract. It is not difficult to see that the totalETH function is simply the total number of ETH of the contract. And the work function itself is a payable function, that is to say, the user can use the work function to control the number of ETH in the contract of ibETH to change the value returned by totalETH. To make matters worse, the work function also supports calling other arbitrary contracts. So the whole idea is clear.

Attack process

1. Make a flash loan from DYDX and lend a large amount of ETH;

2. Use part of ETH to recharge into the contract of RARI Capital, and the ratio obtained from IBeth is still normal at this time;

3. Use the remaining ETH to recharge into the IBeth contract and call the work function of the IBeth contract to prepare for the subsequent push up of the return value of the totalETH of the IBeth contract;

4. At the same time in the work function, withdraw the RARI Capital contract. Since the value of TotalETH () has been pushed up in the previous step, but the value of TotalETH ()/ TotalSupply () calculated is raised relative to the recharge. Thus, the attacker can obtain more ETH from the same amount of REPT from the RARI Capital.

conclusion

After this analysis, the main reason is the incompatibility of the protocol. The attacker attacked the RARI Capital by means of flash lending and reentrant, causing huge losses. The slow fog security team suggests that in the case of DEFI gradually becoming more complex, all DEFI projects need to do a good job of compatibility between protocols when they interact with each other, so as to avoid losses caused by protocol compatibility problems.

[Reference link]

Official analysis by RARI Capital:

https://medium.com/rari-capital/5-8-2021-rari-ethereum-pool-post-mortem-60aab6a6f8f9

Attack transactions (one of them) :

https://etherscan.io/tx/0x171072422efb5cd461546bfe986017d9b5aa427ff1c07ebe8acc064b13a7b7be

The original link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia